Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

901–925 of 30,910 matching · newest first

ExploitedClear filters

High, CVSS 8.815 Oct 2026
Nginx UI: MCP nginx_config_add Bypasses Directive Validation — Authenticated RCE
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · >= 1.9.10-0.20250506154222-1330888280a2, < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84318 · GHSA-9jww-cxg5-rj9m · amended
15 Oct 2026Evidence →
High, CVSS 8.815 Oct 2026
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84317 · GHSA-76pm-mq2q-9gcr · amended
15 Oct 2026Evidence →
Medium, CVSS 6.315 Oct 2026
Nginx UI: Auto backup name allows path traversal outside validated storage path
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260715121709-f92218e01054 (pre-release) or later · < 1.9.10-0.20260715121709-f92218e01054 · CVE-2026-84320 · GHSA-jrq7-xrjx-pcfw · amended
15 Oct 2026Evidence →
High, CVSS 8.315 Oct 2026
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84319 · GHSA-5r62-gj48-897x · amended
15 Oct 2026Evidence →
High, CVSS 7.515 Oct 2026
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
Packagist react/http · Upgrade to 1.11.1 or later · >= 1.0.0, <= 1.11.0 · CVE-2026-104827 · GHSA-g4f2-2pf3-2pwj · amended
15 Oct 2026Evidence →
Unrated15 Oct 2026
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
npm @adonisjs/http-server · Upgrade to 9.1.1 or 8.2.2 by release line · >= 9.0.0, < 9.1.1; <= 8.2.1 · CVE-2026-104150 · GHSA-524c-h47v-m3h8 · amended
15 Oct 2026Evidence →
High, CVSS 7.515 Oct 2026
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
Maven com.github.junrar:junrar · Upgrade to 7.6.1 or later · <= 7.6.0 · CVE-2026-97370 · GHSA-h9h9-2rmf-rvhp · amended
15 Oct 2026Evidence →
High, CVSS 8.215 Oct 2026
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Go github.com/bishopfox/sliver +1 · Upgrade all 2 to 1.7.6 or later · < 1.7.6 · CVE-2026-77622 · GHSA-663m-7x7m-g4fw · amended
15 Oct 2026Evidence →
Medium, CVSS 5.315 Oct 2026
borg extract might modify out-of-tree files when extracting maliciously crafted archives
PyPI borgbackup · Upgrade to 2.0.0b22 (pre-release) or 1.4.5 by release line · < 1.4.5; >= 2.0.0b1, < 2.0.0b22 · CVE-2026-62268 · GHSA-gfp8-w835-v44j · amended
15 Oct 2026Evidence →
Medium, CVSS 6.515 Oct 2026
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
PyPI social-auth-core · Upgrade to 5.0.2 or later · < 5.0.2 · CVE-2026-62322 · GHSA-526j-582w-7fm9 · amended
15 Oct 2026Evidence →
Medium, CVSS 5.315 Oct 2026
MessagePack: Nested arrays can blow past buffer length limits
NuGet messagepack · Upgrade to 3.1.9 or 2.5.303 by release line · < 2.5.303; >= 3.0.0, < 3.1.9 · CVE-2026-92707 · GHSA-qhrr-8q5h-9q3h · amended
15 Oct 2026Evidence →
Medium, CVSS 4.415 Oct 2026
Terragrunt catalog predictable temp symlink clobber
Go github.com/gruntwork-io/terragrunt · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2026-64672 · GHSA-wv6g-x823-wx9m · amended
15 Oct 2026Evidence →
High, CVSS 7.514 Oct 2026
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
NuGet microsoft.openapi.yamlreader · Upgrade to 3.10.0 or 2.12.0 by release line · >= 3.0.0, < 3.10.0; >= 2.0.0-preview.11, < 2.12.0 · +1 more package · CVE-2026-72923 · GHSA-7pxr-59rr-hqj2 · amended
14 Oct 2026Evidence →
Low, CVSS 3.114 Oct 2026
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction
PyPI bbot · Upgrade to 3.0.0 or later · >= 2.3.1, < 3.0.0 · CVE-2026-14966 · GHSA-xpf3-p7gm-7756 · amended
14 Oct 2026Evidence →
Medium, CVSS 6.014 Oct 2026
Metalama allows local code execution through DLL planting in shared temporary directories
NuGet metalama.tool +1 · Upgrade all 2 to 2026.1.19, 2026.0.25 or 2025.1.18 by release line · >= 2026.1.0-preview, < 2026.1.19; < 2025.1.18; >= 2026.0.0-preview, < 2026.0.25 · CVE-2026-62847 · GHSA-m6wq-39m7-9xpp · amended
14 Oct 2026Evidence →
Low, CVSS 3.114 Oct 2026
Apprise forwards configured auth headers across cross-origin HTTP redirects
PyPI apprise · Upgrade to 1.11.0 or later · <= 1.10.0 · CVE-2026-59180 · GHSA-856c-92hv-3vxx · amended
14 Oct 2026Evidence →
Unrated14 Oct 2026
DRUPAL-CORE-2026-016
Packagist drupal/core · Upgrade to 12.0.0-beta2 (pre-release), 11.4.10, 11.3.19 or 10.6.19 by release line · >= 10.3.0, < 10.6.19; >= 11.0.0, < 11.3.19; >= 11.4.0, < 11.4.10; >= 12.0.0-alpha1, < 12.0.0-beta2 · CVE-2026-108514
14 Oct 2026Evidence →
Unrated14 Oct 2026
DRUPAL-CORE-2026-015
Packagist drupal/core · Upgrade to 12.0.0-beta2 (pre-release), 11.4.10, 11.3.19 or 10.6.19 by release line · >= 8.9.0, < 10.6.19; >= 11.0.0, < 11.3.19; >= 11.4.0, < 11.4.10; >= 12.0.0-alpha1, < 12.0.0-beta2 · CVE-2026-108515
14 Oct 2026Evidence →
Unrated14 Oct 2026
DRUPAL-CORE-2026-014
Packagist drupal/core · Upgrade to 12.0.0-beta2 (pre-release), 11.4.10, 11.3.19 or 10.6.19 by release line · >= 8.9.0, < 10.6.19; >= 11.0.0, < 11.3.19; >= 11.4.0, < 11.4.10; >= 12.0.0-alpha1, < 12.0.0-beta2 · CVE-2026-108097
14 Oct 2026Evidence →
Critical, CVSS 9.314 Oct 2026
nodejs-whisper allows OS command injection through crafted audio file paths
npm nodejs-whisper · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2026-110644 · GHSA-2f48-3555-fpx6 · amended
14 Oct 2026Evidence →
Critical, CVSS 9.314 Oct 2026
git-diff: OS command injection vulnerability via crafted strings to the gitDiff API
npm git-diff · Upgrade to 2.0.7 or later · < 2.0.7 · CVE-2026-110634 · GHSA-6wfj-92cw-88vg · amended
14 Oct 2026Evidence →
Medium, CVSS 5.914 Oct 2026
Panic when pending calls are run after a trap
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119138 · GHSA-hmwq-g22x-qjw5 · amended
14 Oct 2026Evidence →
Medium, CVSS 5.914 Oct 2026
Host panic when component call_async is cancelled under some conditions
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119142 · GHSA-3r89-v5mq-j5xf · amended
14 Oct 2026Evidence →
Medium, CVSS 5.314 Oct 2026
Panic on erroneous call-to-host from guest realloc call
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119141 · GHSA-7v24-42x9-pxf7 · amended
14 Oct 2026Evidence →
Low, CVSS 2.314 Oct 2026
rustls: ECH rejection can expose buffered application data to authenticated outer server before ech_required alert
crates.io rustls · Upgrade to 0.24.0-dev.2 (pre-release) or 0.23.46 by release line · >= 0.23.44, < 0.23.46; >= 0.24.0-dev.1, < 0.24.0-dev.2 · CVE-2026-123612 · GHSA-vp88-798v-h67f · amended
14 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Nginx UI: Auto backup name allows path traversal outside validated storage path

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

borg extract might modify out-of-tree files when extracting maliciously crafted archives

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

MessagePack: Nested arrays can blow past buffer length limits

Terragrunt catalog predictable temp symlink clobber

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction

Metalama allows local code execution through DLL planting in shared temporary directories

Apprise forwards configured auth headers across cross-origin HTTP redirects

DRUPAL-CORE-2026-016

DRUPAL-CORE-2026-015

DRUPAL-CORE-2026-014

nodejs-whisper allows OS command injection through crafted audio file paths

git-diff: OS command injection vulnerability via crafted strings to the gitDiff API

Panic when pending calls are run after a trap

Host panic when component `call_async` is cancelled under some conditions

Panic on erroneous call-to-host from guest realloc call

rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence